ssh-keysign(8) belongs in /usr/libexec, not in /usr/bin, and needs to be

setuid so ssh(1) doesn't have to be.

Pointy hat to:	des
Submitted by:	Katsuyuki TATEISHI <katsu@iec.hiroshima-u.ac.jp>

secure/libexec/Makefile

@@ -4,7 +4,7 @@
 SUBDIR= telnetd
 .endif
 .if !defined(NO_OPENSSL) && !defined(NO_OPENSSH)
-SUBDIR+=sftp-server
+SUBDIR+=sftp-server ssh-keysign
 .endif
 
 .include <bsd.subdir.mk>

secure/libexec/ssh-keysign/Makefile

@@ -3,6 +3,9 @@
 PROG=	ssh-keysign
 MAN=	ssh-keysign.8
 CFLAGS+=-I${SSHDIR}
+.if defined(ENABLE_SUID_SSH)
+BINMODE=4511
+.endif
 
 DPADD=	${LIBSSH} ${LIBCRYPTO} ${LIBZ}
 LDADD=	-lssh -lcrypto -lz

secure/usr.bin/Makefile

@@ -7,7 +7,7 @@ SUBDIR+=telnet
 .if !defined(NO_OPENSSL)
 SUBDIR+=openssl
 .if !defined(NO_OPENSSH)
-SUBDIR+=scp sftp ssh ssh-add ssh-agent ssh-keygen ssh-keyscan ssh-keysign
+SUBDIR+=scp sftp ssh ssh-add ssh-agent ssh-keygen ssh-keyscan
 .endif
 .endif
 

secure/usr.bin/ssh/Makefile

@@ -3,9 +3,6 @@
 
 PROG=	ssh
 CFLAGS+=-I${SSHDIR}
-.if defined(ENABLE_SUID_SSH)
-BINMODE=4555
-.endif
 LINKS=	${BINDIR}/ssh ${BINDIR}/slogin
 MAN=	ssh.1 ssh_config.5
 MLINKS=	ssh.1 slogin.1